Abuse the Module

Approximately 360,000,000 people use Firefox every single day. 90 % of them or 324,000,000 people use Windows computers. Using a small utility called PasswordFox.exe, I can steal at least 324,000,000 passwords in all of 60 seconds.

This is what happens when a hacker abuses the module - and today, we'll go behind the screen to watch what really happens.

According to Tim Johnson at the Mcclatchy Washington Bureau,

The average person is registered to 90 online accounts requiring passwords, and the number keeps growing

Not many people are capable of remembering 90 passwords - and our entire online experience depends on access to these accounts - but no one ever thinks it, because our browsers, be it Chrome or Firefox save our passwords and do all the work for us. However, because we never think about it, we never stop to ask where those passwords actually are.

You're looking at a screenshot of our trusty partner x64dbg recording Firefox saving my passwords. Highlighted is a call to a function called PK11_ENCRYPT that lives in a module called NS33.dll. Firefox uses the above-mentioned function to store and encrypt my password. Sounds safe, right?

Above is a recording of Firefox retrieving my passwords. As soon as I click "show passwords", a call is made to PK11_DECRYPT that decrypts and retrieves your password. Still seems pretty safe right?

Wrong

PasswordFox can (maliciously) use the PK11_DECRYPT function the same way Firefox can. There are two screenshots below. One is a recording of Firefox, and one of PasswordFox. Highlighted in both is the same exact call, to the same exact function - you guessed it - PK11_DECRYPT.

Operating Systems and many other things in the computing world were designed with trust in mind. Everyone can do everything, because why would anyone want to do anything malicious? In today's world, where huge sums of money stand to be easily made by abusing that naive trust, it doesn't really work.

Using sophisticated reverse engineering techniques, Vicarius Topia can identify modules that are likely to suffer abuse, and restrict access to them. With Topia in place, the next time PasswordFox tries to abuse the module, it'll be identified as an intruder, and promptly blocked.

Other popular security software will generally notify you of an attack, but can't do much to prevent it. This is why you need Vicarius Topia - no one else can keep you safe.